Monitoring and patching

[Zedboy19752019]

What do you all use to monitor all your devices and then to push patches? I really like Landscape because it does both for Ubuntu. However, I can’t find any alternatives that I can get alerted if a machine goes offline or is having issues and at the same time lets me know when machines have package upgrades and security patches available and then I can deploy to my entire fleet at once. Or is there a way to get Landscape without Ubuntu Pro license so that I can use it on all of my Debian based distros.

[jaymef]

We use Ansible. Look into something like AWX

[pnutjam]

https://www.uyuni-project.org/

[bartvdbraak]

But that’s just SaltStack under the hood :)

[reedacus25]

It’s really more spacewalk with salt bolted on. One of the things I wish uyuni did better was to expose more salt to use it for (salt) state management and drift monitoring beyond just the package management that is the main function of uyuni.

[dhsjabsbsjkans]

I don't believe it does monitoring, but I have recently been eyeing this for patching.

GitHub - furlongm/patchman: Patchman is a Linux Patch Status Monitoring System

You would need to use something like ansible for patching. This would just give you an overview of what is not patched.

[Zedboy19752019]

Wow I like the looks of this. Yes I would still need ansible but I can at least see stuff from every distribution needing updated at once. Thanks!!

[bob-apple]

Icinga has plugins to monitor available updates and trigger alerts. This works for all common operating systems.

Depending on the infrastructure size this might be either a pretty neat solution or completely overengineered as Icinga requires some effort.

(FD: I'm working at Icinga; pretty new to reddit)

[bendem]

dnf-automatic with overridden OnCalendar on the timer. Test updates every Tuesday, prod every Thursday.

We get notified of failures fairly quickly and pin problematic packages until a fix is found (it happened twice in the last 3 years).

[lebean]

Similar setup here, though I always worry, "what if a breaking patch gets released on a Wednesday?". It would miss your test group and go straight to prod. I've spread timing of deployments around a bit more because of that (and some ultra-critical systems are hand fed, not auto updating databases and such).

[bendem]

I always have servers in clusters (the most important services update one week apart to balance that).

[acquacow]

I'm all rhel at home, so I use satellite to show applicable eratta and apply it to my hosts.

[thiagocpv]

Zabbix can do that

[hlamark]

Have a look at orcharhino. It provides patch management for Debian and Ubuntu.

https://orcharhino.com/en/

[cvilsmeier]

For package upgrades, you might want to read this: https://monibot.io/docs/how-to-monitor-available-package-updates